From 2912bc640b3335bffe20d03afa74d84c7a3c4f56 Mon Sep 17 00:00:00 2001
From: benrubson <6764151+benrubson@users.noreply.github.com>
Date: Thu, 9 Apr 2020 16:42:08 +0200
Subject: [PATCH 1/2] New Gitlab jail
---
config/filter.d/gitlab.conf | 6 ++++++
config/jail.conf | 4 ++++
fail2ban/tests/files/logs/gitlab | 5 +++++
3 files changed, 15 insertions(+)
create mode 100644 config/filter.d/gitlab.conf
create mode 100644 fail2ban/tests/files/logs/gitlab
diff --git a/config/filter.d/gitlab.conf b/config/filter.d/gitlab.conf
new file mode 100644
index 00000000..0c614ae5
--- /dev/null
+++ b/config/filter.d/gitlab.conf
@@ -0,0 +1,6 @@
+# Fail2Ban filter for Gitlab
+# Detecting unauthorized access to the Gitlab Web portal
+# typically logged in /var/log/gitlab/gitlab-rails/application.log
+
+[Definition]
+failregex = ^: Failed Login: username=.+ ip=$
diff --git a/config/jail.conf b/config/jail.conf
index f7c84fac..e5d16656 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -821,6 +821,10 @@ udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010
action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
%(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+[gitlab]
+port = http,https
+logpath = /var/log/gitlab/gitlab-rails/application.log
+
[bitwarden]
port = http,https
logpath = /home/*/bwdata/logs/identity/Identity/log.txt
diff --git a/fail2ban/tests/files/logs/gitlab b/fail2ban/tests/files/logs/gitlab
new file mode 100644
index 00000000..222df642
--- /dev/null
+++ b/fail2ban/tests/files/logs/gitlab
@@ -0,0 +1,5 @@
+# Access of unauthorized host in /var/log/gitlab/gitlab-rails/application.log
+# failJSON: { "time": "2020-04-09T14:04:00", "match": true , "host": "80.10.11.12" }
+2020-04-09T14:04:00.667Z: Failed Login: username=admin ip=80.10.11.12
+# failJSON: { "time": "2020-04-09T14:15:09", "match": true , "host": "80.10.11.12" }
+2020-04-09T14:15:09.344Z: Failed Login: username=user name ip=80.10.11.12
From 78651de7e504bad84e73040dfd7ea530591d0385 Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester"
Date: Tue, 14 Apr 2020 12:25:18 +0200
Subject: [PATCH 2/2] Update ChangeLog
---
ChangeLog | 1 +
1 file changed, 1 insertion(+)
diff --git a/ChangeLog b/ChangeLog
index 3781f467..c722db2b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -42,6 +42,7 @@ ver. 0.10.6-dev (20??/??/??) - development edition
should be interpolated in definition section (inside the filter-config, gh-2650)
### New Features
+* new filter and jail for GitLab recognizing failed application logins (gh-2689)
### Enhancements
* introduced new prefix `{UNB}` for `datepattern` to disable word boundaries in regex;